[Impala-ASF-CR] IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges
Impala Public Jenkins has submitted this change and it was merged. ( http://gerrit.cloudera.org:8080/8973 ) Change subject: IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges .. IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges USE and SHOW TABLES should be allowed if there is at least one table in a database where the user has table or column privileges. Impala incorrectly checked only for table privileges. To test this issue in AuthorizationTest.java, 'functional_avro' is added as a test database with only column level permissions. Change-Id: Ia69756a18cb1db304d2bb8c92288612cbd1164d8 Reviewed-on: http://gerrit.cloudera.org:8080/8973 Reviewed-by: Alex BehmTested-by: Impala Public Jenkins --- M fe/src/main/java/org/apache/impala/analysis/AnalysisContext.java M fe/src/main/java/org/apache/impala/analysis/Analyzer.java M fe/src/test/java/org/apache/impala/analysis/AuthorizationTest.java M fe/src/test/resources/authz-policy.ini.template 4 files changed, 29 insertions(+), 6 deletions(-) Approvals: Alex Behm: Looks good to me, approved Impala Public Jenkins: Verified -- To view, visit http://gerrit.cloudera.org:8080/8973 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: merged Gerrit-Change-Id: Ia69756a18cb1db304d2bb8c92288612cbd1164d8 Gerrit-Change-Number: 8973 Gerrit-PatchSet: 6 Gerrit-Owner: Csaba Ringhofer Gerrit-Reviewer: Alex Behm Gerrit-Reviewer: Attila Jeges Gerrit-Reviewer: Csaba Ringhofer Gerrit-Reviewer: Dimitris Tsirogiannis Gerrit-Reviewer: Gabor Kaszab Gerrit-Reviewer: Impala Public Jenkins Gerrit-Reviewer: Lars Volker Gerrit-Reviewer: Laszlo Gaal
[Impala-ASF-CR] IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/8973 ) Change subject: IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges .. Patch Set 5: Verified+1 -- To view, visit http://gerrit.cloudera.org:8080/8973 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ia69756a18cb1db304d2bb8c92288612cbd1164d8 Gerrit-Change-Number: 8973 Gerrit-PatchSet: 5 Gerrit-Owner: Csaba RinghoferGerrit-Reviewer: Alex Behm Gerrit-Reviewer: Attila Jeges Gerrit-Reviewer: Csaba Ringhofer Gerrit-Reviewer: Dimitris Tsirogiannis Gerrit-Reviewer: Gabor Kaszab Gerrit-Reviewer: Impala Public Jenkins Gerrit-Reviewer: Lars Volker Gerrit-Reviewer: Laszlo Gaal Gerrit-Comment-Date: Wed, 17 Jan 2018 22:40:11 + Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges
Impala Public Jenkins has posted comments on this change. ( http://gerrit.cloudera.org:8080/8973 ) Change subject: IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges .. Patch Set 5: Build started: https://jenkins.impala.io/job/gerrit-verify-dryrun/1735/ -- To view, visit http://gerrit.cloudera.org:8080/8973 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ia69756a18cb1db304d2bb8c92288612cbd1164d8 Gerrit-Change-Number: 8973 Gerrit-PatchSet: 5 Gerrit-Owner: Csaba RinghoferGerrit-Reviewer: Alex Behm Gerrit-Reviewer: Attila Jeges Gerrit-Reviewer: Csaba Ringhofer Gerrit-Reviewer: Dimitris Tsirogiannis Gerrit-Reviewer: Gabor Kaszab Gerrit-Reviewer: Impala Public Jenkins Gerrit-Reviewer: Lars Volker Gerrit-Reviewer: Laszlo Gaal Gerrit-Comment-Date: Wed, 17 Jan 2018 19:00:17 + Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges
Alex Behm has posted comments on this change. ( http://gerrit.cloudera.org:8080/8973 ) Change subject: IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges .. Patch Set 5: Code-Review+2 Thanks for moving the tests! Much better now :) -- To view, visit http://gerrit.cloudera.org:8080/8973 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ia69756a18cb1db304d2bb8c92288612cbd1164d8 Gerrit-Change-Number: 8973 Gerrit-PatchSet: 5 Gerrit-Owner: Csaba RinghoferGerrit-Reviewer: Alex Behm Gerrit-Reviewer: Attila Jeges Gerrit-Reviewer: Csaba Ringhofer Gerrit-Reviewer: Dimitris Tsirogiannis Gerrit-Reviewer: Gabor Kaszab Gerrit-Reviewer: Lars Volker Gerrit-Reviewer: Laszlo Gaal Gerrit-Comment-Date: Wed, 17 Jan 2018 18:59:37 + Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges
Csaba Ringhofer has posted comments on this change. ( http://gerrit.cloudera.org:8080/8973 ) Change subject: IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges .. Patch Set 5: (2 comments) http://gerrit.cloudera.org:8080/#/c/8973/3/fe/src/test/java/org/apache/impala/analysis/AuthorizationTest.java File fe/src/test/java/org/apache/impala/analysis/AuthorizationTest.java: http://gerrit.cloudera.org:8080/#/c/8973/3/fe/src/test/java/org/apache/impala/analysis/AuthorizationTest.java@102 PS3, Line 102: // SELECT permissions on columns ('id') on 'functional_avro.alltypessmall' > missing opening single-quote for 'functional_avro.alltypessmall' Done http://gerrit.cloudera.org:8080/#/c/8973/3/fe/src/test/java/org/apache/impala/analysis/AuthorizationTest.java@399 PS3, Line 399: privilege = new TPrivilege("", TPrivilegeLevel.SELECT, > typo: privilege (which has already been declared) Thanks for spotting it! Please ignore patch set 4, and compare 3 to 5. Note that it may look like if this could fit into 1 line, but it would be 91 characters. -- To view, visit http://gerrit.cloudera.org:8080/8973 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ia69756a18cb1db304d2bb8c92288612cbd1164d8 Gerrit-Change-Number: 8973 Gerrit-PatchSet: 5 Gerrit-Owner: Csaba RinghoferGerrit-Reviewer: Alex Behm Gerrit-Reviewer: Attila Jeges Gerrit-Reviewer: Csaba Ringhofer Gerrit-Reviewer: Dimitris Tsirogiannis Gerrit-Reviewer: Gabor Kaszab Gerrit-Reviewer: Lars Volker Gerrit-Reviewer: Laszlo Gaal Gerrit-Comment-Date: Wed, 17 Jan 2018 13:34:55 + Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges
Hello Lars Volker, Laszlo Gaal, Gabor Kaszab, Attila Jeges, Dimitris Tsirogiannis, Alex Behm, I'd like you to reexamine a change. Please visit http://gerrit.cloudera.org:8080/8973 to look at the new patch set (#5). Change subject: IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges .. IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges USE and SHOW TABLES should be allowed if there is at least one table in a database where the user has table or column privileges. Impala incorrectly checked only for table privileges. To test this issue in AuthorizationTest.java, 'functional_avro' is added as a test database with only column level permissions. Change-Id: Ia69756a18cb1db304d2bb8c92288612cbd1164d8 --- M fe/src/main/java/org/apache/impala/analysis/AnalysisContext.java M fe/src/main/java/org/apache/impala/analysis/Analyzer.java M fe/src/test/java/org/apache/impala/analysis/AuthorizationTest.java M fe/src/test/resources/authz-policy.ini.template 4 files changed, 29 insertions(+), 6 deletions(-) git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/73/8973/5 -- To view, visit http://gerrit.cloudera.org:8080/8973 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: newpatchset Gerrit-Change-Id: Ia69756a18cb1db304d2bb8c92288612cbd1164d8 Gerrit-Change-Number: 8973 Gerrit-PatchSet: 5 Gerrit-Owner: Csaba RinghoferGerrit-Reviewer: Alex Behm Gerrit-Reviewer: Attila Jeges Gerrit-Reviewer: Csaba Ringhofer Gerrit-Reviewer: Dimitris Tsirogiannis Gerrit-Reviewer: Gabor Kaszab Gerrit-Reviewer: Lars Volker Gerrit-Reviewer: Laszlo Gaal
[Impala-ASF-CR] IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges
Hello Lars Volker, Laszlo Gaal, Gabor Kaszab, Attila Jeges, Dimitris Tsirogiannis, Alex Behm, I'd like you to reexamine a change. Please visit http://gerrit.cloudera.org:8080/8973 to look at the new patch set (#4). Change subject: IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges .. IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges USE and SHOW TABLES should be allowed if there is at least one table in a database where the user has table or column privileges. Impala incorrectly checked only for table privileges. To test this issue in AuthorizationTest.java, 'functional_avro' is added as a test database with only column level permissions. Change-Id: Ia69756a18cb1db304d2bb8c92288612cbd1164d8 --- M fe/src/main/java/org/apache/impala/analysis/AnalysisContext.java M fe/src/main/java/org/apache/impala/analysis/Analyzer.java M fe/src/test/java/org/apache/impala/analysis/AuthorizationTest.java M fe/src/test/resources/authz-policy.ini.template 4 files changed, 29 insertions(+), 6 deletions(-) git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/73/8973/4 -- To view, visit http://gerrit.cloudera.org:8080/8973 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: newpatchset Gerrit-Change-Id: Ia69756a18cb1db304d2bb8c92288612cbd1164d8 Gerrit-Change-Number: 8973 Gerrit-PatchSet: 4 Gerrit-Owner: Csaba RinghoferGerrit-Reviewer: Alex Behm Gerrit-Reviewer: Attila Jeges Gerrit-Reviewer: Csaba Ringhofer Gerrit-Reviewer: Dimitris Tsirogiannis Gerrit-Reviewer: Gabor Kaszab Gerrit-Reviewer: Lars Volker Gerrit-Reviewer: Laszlo Gaal
[Impala-ASF-CR] IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges
Alex Behm has posted comments on this change. ( http://gerrit.cloudera.org:8080/8973 ) Change subject: IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges .. Patch Set 3: (2 comments) http://gerrit.cloudera.org:8080/#/c/8973/3/fe/src/test/java/org/apache/impala/analysis/AuthorizationTest.java File fe/src/test/java/org/apache/impala/analysis/AuthorizationTest.java: http://gerrit.cloudera.org:8080/#/c/8973/3/fe/src/test/java/org/apache/impala/analysis/AuthorizationTest.java@102 PS3, Line 102: // SELECT permissions on columns ('id') on functional_avro.alltypessmall' missing opening single-quote for 'functional_avro.alltypessmall' http://gerrit.cloudera.org:8080/#/c/8973/3/fe/src/test/java/org/apache/impala/analysis/AuthorizationTest.java@399 PS3, Line 399: TPrivilege privilige = new TPrivilege("", TPrivilegeLevel.SELECT, typo: privilege (which has already been declared) -- To view, visit http://gerrit.cloudera.org:8080/8973 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ia69756a18cb1db304d2bb8c92288612cbd1164d8 Gerrit-Change-Number: 8973 Gerrit-PatchSet: 3 Gerrit-Owner: Csaba RinghoferGerrit-Reviewer: Alex Behm Gerrit-Reviewer: Attila Jeges Gerrit-Reviewer: Csaba Ringhofer Gerrit-Reviewer: Dimitris Tsirogiannis Gerrit-Reviewer: Gabor Kaszab Gerrit-Reviewer: Lars Volker Gerrit-Reviewer: Laszlo Gaal Gerrit-Comment-Date: Tue, 16 Jan 2018 23:17:06 + Gerrit-HasComments: Yes
[Impala-ASF-CR] IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges
Csaba Ringhofer has posted comments on this change. ( http://gerrit.cloudera.org:8080/8973 ) Change subject: IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges .. Patch Set 3: > Why do you say that change is more complex? Picking a pre-existing database, and setting it up as needed for the test seemed more error prone to me than creating a minimal temporary db. Now (after creating the AuthorizationTest.java tests) I agree that they have a better place in java. -- To view, visit http://gerrit.cloudera.org:8080/8973 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ia69756a18cb1db304d2bb8c92288612cbd1164d8 Gerrit-Change-Number: 8973 Gerrit-PatchSet: 3 Gerrit-Owner: Csaba RinghoferGerrit-Reviewer: Alex Behm Gerrit-Reviewer: Attila Jeges Gerrit-Reviewer: Csaba Ringhofer Gerrit-Reviewer: Dimitris Tsirogiannis Gerrit-Reviewer: Gabor Kaszab Gerrit-Reviewer: Lars Volker Gerrit-Reviewer: Laszlo Gaal Gerrit-Comment-Date: Tue, 16 Jan 2018 20:26:06 + Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges
Csaba Ringhofer has posted comments on this change. ( http://gerrit.cloudera.org:8080/8973 ) Change subject: IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges .. Patch Set 3: > > Dimitris, what is your opinion about the best place for these > > tests? Should it be AuthorizationTest.java, or grant_revoke.test, > > or both? Adding them to AuthorizationTest.java would mean that > one > > of the common databases should be set up to contain only column > > privileges. > > I prefer the AuthorizationTest.java (tests TestUseDb and > TestShowTable..., for this patch) even if that means expanding our > initial auth setup. Feel free to pick any database not currently > used by these tests. Don't forget to modify the authz-policy.ini I have moved the tests to > > Dimitris, what is your opinion about the best place for these > > tests? Should it be AuthorizationTest.java, or grant_revoke.test, > > or both? Adding them to AuthorizationTest.java would mean that > one > > of the common databases should be set up to contain only column > > privileges. > > I prefer the AuthorizationTest.java (tests TestUseDb and > TestShowTable..., for this patch) even if that means expanding our > initial auth setup. Feel free to pick any database not currently > used by these tests. Don't forget to modify the authz-policy.ini I have moved the tests to AuthorizationTest.java. About authz-policy.ini: I copied the changed file to hdfs manually. Shouldn't one of the build or test steps detect the change, and update this file? -- To view, visit http://gerrit.cloudera.org:8080/8973 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ia69756a18cb1db304d2bb8c92288612cbd1164d8 Gerrit-Change-Number: 8973 Gerrit-PatchSet: 3 Gerrit-Owner: Csaba RinghoferGerrit-Reviewer: Alex Behm Gerrit-Reviewer: Attila Jeges Gerrit-Reviewer: Csaba Ringhofer Gerrit-Reviewer: Dimitris Tsirogiannis Gerrit-Reviewer: Gabor Kaszab Gerrit-Reviewer: Lars Volker Gerrit-Reviewer: Laszlo Gaal Gerrit-Comment-Date: Tue, 16 Jan 2018 19:11:09 + Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges
Hello Lars Volker, Laszlo Gaal, Gabor Kaszab, Attila Jeges, Dimitris Tsirogiannis, Alex Behm, I'd like you to reexamine a change. Please visit http://gerrit.cloudera.org:8080/8973 to look at the new patch set (#3). Change subject: IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges .. IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges USE and SHOW TABLES should be allowed if there is at least one table in a database where the user has table or column privileges. Impala incorrectly checked only for table privileges. To test this issue in AuthorizationTest.java, 'functional_avro' is added as a test database with only column level permissions. Change-Id: Ia69756a18cb1db304d2bb8c92288612cbd1164d8 --- M fe/src/main/java/org/apache/impala/analysis/AnalysisContext.java M fe/src/main/java/org/apache/impala/analysis/Analyzer.java M fe/src/test/java/org/apache/impala/analysis/AuthorizationTest.java M fe/src/test/resources/authz-policy.ini.template 4 files changed, 29 insertions(+), 6 deletions(-) git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/73/8973/3 -- To view, visit http://gerrit.cloudera.org:8080/8973 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: newpatchset Gerrit-Change-Id: Ia69756a18cb1db304d2bb8c92288612cbd1164d8 Gerrit-Change-Number: 8973 Gerrit-PatchSet: 3 Gerrit-Owner: Csaba RinghoferGerrit-Reviewer: Alex Behm Gerrit-Reviewer: Attila Jeges Gerrit-Reviewer: Csaba Ringhofer Gerrit-Reviewer: Dimitris Tsirogiannis Gerrit-Reviewer: Gabor Kaszab Gerrit-Reviewer: Lars Volker Gerrit-Reviewer: Laszlo Gaal
[Impala-ASF-CR] IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges
Alex Behm has posted comments on this change. ( http://gerrit.cloudera.org:8080/8973 ) Change subject: IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges .. Patch Set 1: I think we should extend AuthorizationTest#TestUseDb() which means adding a Db with only column level privileges. Why do you say that change is more complex? To me it's cognitively more complex and less organized to have some parts of "USE " authorization tested in grant_revoke.test and some parts tested in AuthorizationTest#TestUseDb(). I think they all belong in AuthorizationTest#TestUseDb(). -- To view, visit http://gerrit.cloudera.org:8080/8973 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: Ia69756a18cb1db304d2bb8c92288612cbd1164d8 Gerrit-Change-Number: 8973 Gerrit-PatchSet: 1 Gerrit-Owner: Csaba RinghoferGerrit-Reviewer: Alex Behm Gerrit-Reviewer: Attila Jeges Gerrit-Reviewer: Csaba Ringhofer Gerrit-Reviewer: Dimitris Tsirogiannis Gerrit-Reviewer: Gabor Kaszab Gerrit-Reviewer: Lars Volker Gerrit-Reviewer: Laszlo Gaal Gerrit-Comment-Date: Sat, 13 Jan 2018 00:23:56 + Gerrit-HasComments: No
[Impala-ASF-CR] IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges
Csaba Ringhofer has uploaded this change for review. ( http://gerrit.cloudera.org:8080/8973 Change subject: IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges .. IMPALA-4315: Allow USE and SHOW TABLES if the user has only column privileges USE and SHOW TABLES should be allowed if there is at least one table in a database where the user has table or column privileges. Impala incorrectly checked only for table privileges. All automatic tests were added to grant_revoke.test, so AuthorizationTest.java is not changed - the reason for this is that adding a db with only column privileges to AuthorizationTest.java seemed more complex. Change-Id: Ia69756a18cb1db304d2bb8c92288612cbd1164d8 --- M fe/src/main/java/org/apache/impala/analysis/AnalysisContext.java M fe/src/main/java/org/apache/impala/analysis/Analyzer.java M testdata/workloads/functional-query/queries/QueryTest/grant_revoke.test 3 files changed, 56 insertions(+), 3 deletions(-) git pull ssh://gerrit.cloudera.org:29418/Impala-ASF refs/changes/73/8973/1 -- To view, visit http://gerrit.cloudera.org:8080/8973 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: newchange Gerrit-Change-Id: Ia69756a18cb1db304d2bb8c92288612cbd1164d8 Gerrit-Change-Number: 8973 Gerrit-PatchSet: 1 Gerrit-Owner: Csaba RinghoferGerrit-Reviewer: Attila Jeges Gerrit-Reviewer: Csaba Ringhofer Gerrit-Reviewer: Gabor Kaszab Gerrit-Reviewer: Lars Volker Gerrit-Reviewer: Laszlo Gaal